This is not exploiting INSERT INTO; it's exploiting horrible developers.

Rule #1: Never trust the user.